Search warrants

What Dropbox received

Search warrants require a showing of probable cause, must meet specificity requirements regarding the location to be searched and the items to be seized, and must be reviewed and signed by a judge or magistrate. Search warrants may be issued by local, state, or federal governments, and may only be used in criminal cases. In response to valid search warrants, we produce non-content and content information.

Search warrants

How we responded

Does not exist

No information provided

Content provided

Notice provided

Accounts listed in warrants

How we responded

Does not exist

No information provided

Content provided

Notice provided

A note to provide context

Anytime Dropbox complies with a search warrant, we notify the users named in the request unless prohibited by law. The shaded portion of the pie chart above represents users to whom we gave notice, of the users whose content we provided to law enforcement.

Between January and June 2017, we received indefinite court orders of non-disclosure for 45.4% of the search warrants we received. These court orders may prevent us from ever notifying 45.1% of the Dropbox users named in a search warrant of the request for their information.

Subpoenas

What Dropbox received

Unlike a search warrant, a subpoena only allows access to basic subscriber information. Subpoenas do not require judicial review, and are typically issued by government attorneys or grand juries. We do not provide content information in response to subpoenas.

Subpoenas

How we responded

Does not exist

Content provided

No information provided

Non-content provided

Notice provided

Accounts listed in subpoenas

How we responded

Does not exist

Content provided

No information provided

Non-content provided

Notice provided

A note to provide context

Anytime Dropbox complies with a subpoena for non-content, we notify the users named in the request unless prohibited by law. The shaded portion of the pie chart above represents users to whom we gave notice, of the users whose non-content we provided to law enforcement.

Between January and June 2017, we received indefinite court orders of non-disclosure for 19.5% of the subpoenas we received. These court orders may prevent us from ever notifying 16.7% of the Dropbox users named in a subpoena of the request for their information.

Court orders

What Dropbox received

Court orders are issued by judges and may take a variety of forms, such as a 2703(d) order under the Electronic Communications Privacy Act. We do not provide content information in response to court orders.

Court Orders

How we responded

Does not exist

Content provided

No information provided

Non-content provided

Notice provided

Accounts listed in court orders

How we responded

Does not exist

Content provided

No information provided

Non-content provided

Notice provided

A note to provide context

Anytime Dropbox complies with a court order, we notify the users named in the request unless prohibited by law. The shaded portion of the pie chart above represents users to whom we gave notice, of the users whose non-content we provided to law enforcement.

Between January and June 2017, we received indefinite court orders of non-disclosure for 45.0% of the court orders we received. These court orders may prevent us from ever notifying 39.1% of the Dropbox users named in a court order of the request for their information.

Government removal requests

What Dropbox received

Government removal requests include court orders and written requests from law enforcement and government agencies seeking the removal of content based on the local laws of their respective jurisdictions.

National security requests

What Dropbox received

National security process includes National Security Letters and orders issued under the Foreign Intelligence Surveillance Act. We’d like to be more specific, but Dropbox is not permitted by the US government to report the exact number received.

National security requests

How we responded

Does not exist

No information Provided

Content provided

Notice given

Accounts listed in requests

How we responded

Does not exist

No information Provided

Content provided

Notice given

A note about national security process

National Security Letters (“NSLs”) are requests from the Federal Bureau of Investigation for information relevant to a national security investigation. An NSL doesn’t require a court order, but may only request a user’s “name, address, length of service, and local and long distance toll billing records.”

Foreign Intelligence Surveillance Act orders (“FISA orders”) are orders issued by the Foreign Intelligence Surveillance Court (“FISC”) for information relevant to a national security investigation. A FISA order may request a user’s non-content and content information.

United States

A note about state-level requests

Dropbox receives requests from state law enforcement agencies and federal agencies with in-state offices. We evaluate each request according to federal and local law, and our guiding government data request principles.

Requests per 1 million residents

Total requests per state

A note to provide context

Between January and June 2017, Dropbox received one subpoena from a US foreign embassy. We provided non-content in response to the subpoena.

Non-US

A note about non-US requests

Non-US requests include any formal legal process from a non-US government seeking user data. At this time, we typically require non-US governments to follow the Mutual Legal Assistance Treaty process or letters rogatory process so that a US court will issue the required US legal process to Dropbox.

Requests Dropbox received

A note to provide context

Between January and June 2017, Dropbox complied with one non-US request for user data. We provided non-content in response to the request.

Beyond the numbers

January 2017 - June 2017

The only order Dropbox received under the All Writs Act of 1789 required physical delivery of content that Dropbox produced in response to a legally valid warrant. We received no orders under the All Writs Act requesting that Dropbox circumvent security features or otherwise compromise the integrity of our services.

We received three requests for information addressed to the wrong company. We required that law enforcement remedy these errors.

We received one court-ordered pen register/trap and trace order (PRTT), which ordered Dropbox to produce information for a specified period of time after the service of the order. Dropbox found no information responsive to the order. The court issued an order of indefinite non-disclosure preventing us from notifying the user.

Glossary

User Notice: Anytime we comply with a request from law enforcement for a user’s information, we notify the user unless we are legally prohibited from doing so. In limited cases, we delay notice to the user until after we have complied, and in those cases we note the date we produced user records.

Non-content: “Non-content” includes things such as the name and email address associated with the account, the date of account creation and other transactional information like IP addresses. “Non-content” information does not include the files that people store in their Dropbox accounts.

Content: "Content” information includes the files stored in a person’s Dropbox account. We also typically produce basic subscriber information with content.

“No information provided”: Dropbox provided no information because, either: (1) the request was a duplicate; (2) Dropbox objected to the request; (3) law enforcement withdrew the request; or (4) the request failed to specify an account.

“Account did not exist”: Dropbox had no record of the account listed in the request.

All Writs Act Orders: All Writs Act Orders are issued by United States judges with authority from the All Writs Act of 1789. The statute gives courts the power to “issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.”

Non-US requests: Non-US requests include any formal legal process from a non-US government seeking user data. At this time, we typically require non-US governments to follow the Mutual Legal Assistance Treaty process or letters rogatory process so that a US court will issue the required US legal process to Dropbox.

Government removal requests: Government removal requests include court orders, and written requests from law enforcement and government agencies seeking the removal of content based on the local laws of their respective jurisdictions.

Non-disclosure order: At their discretion, judges can issue court orders of non-disclosure preventing Dropbox from notifying a user of a government request for their information. These orders often cite subsection 2705(b) of the Electronic Communications Privacy Act and can extend for any length of time.

Our tracking and reporting methods may evolve as we continually strive to improve the accuracy and clarity of our report.